82a358f18d
ontoref-derive: #[onto_mcp_tool] attribute macro registers MCP tool unit-structs in
the catalog at link time via inventory::submit!; annotated item is emitted unchanged,
ToolBase/AsyncTool impls stay on the struct. All 34 tools migrated from manual wiring
(net +5: ontoref_list_projects, ontoref_search, ontoref_describe,
ontoref_list_ontology_extensions, ontoref_get_ontology_extension).
validate modes (ADR-018): reads level_hierarchy from workflow.ncl and checks every
.ncl mode for level declared, strategy declared, delegate chain coherent, compose
extends valid. mode resolve <id> shows which hierarchy level handles a mode and why.
--self-test generates synthetic fixtures in a temp dir for CI smoke-testing.
validate run-cargo: two-step Cargo.toml resolution — workspace layout first
(crates/<check.crate>/Cargo.toml), single-crate fallback by package name or repo
basename. Lets the same ADR constraint shape apply to workspace and single-crate repos.
ontology/schemas/manifest.ncl: registry_topology_type contract — multi-registry
coordination, push targets, participant scopes, per-namespace capability.
reflection/requirements/base.ncl: oras ≥1.2.0, cosign ≥2.0.0, sops ≥3.9.0, age
≥1.1.0, restic declared as Hard/Soft requirements with version_min, check_cmd, and
install_hint (ADR-017 toolchain surface).
ADR-019: per-file recipient routing for tenant isolation without multi-vault. Schema
additions: sops.recipient_groups + sops.recipient_rules in ontoref-project.ncl.
secrets-bootstrap generates .sops.yaml from project.ncl in declarative mode. Three
new secrets-audit checks: recipient-routing-coherent, recipient-routing-coverage,
no-multi-vault. Adoption templates: single-team/, multi-tenant/, agent-first/.
Integration templates: domain-producer/, mode-producer/, mode-consumer/.
UI: project_picker surfaces registry badge (⟳ participant) and vault badge
(⛁ vault_id · N, green=declarative / amber=legacy) per project card. Expanded panel
adds collapsible Registry section with namespace, endpoint, and push/pull capability.
manage.html gains Runtime Services card — MCP and GraphQL toggleable without restart
via HTMX POST /ui/manage/services/{service}/toggle.
describe.nu: capabilities JSON includes registry_topology and vault_state per project.
sync.nu: drift check extended to detect //! absence on newly registered crates.
qa.ncl: six entries — credential-vault-best-practice (layered data-flow diagram),
credential-vault-templates (paths A/B/C), credential-vault-troubleshooting (15 named
errors), integration-what-and-why (ADR-042 OCI federation), integration-how-to-implement,
integration-troubleshooting.
on+re: core.ncl + manifest.ncl updated to reflect OCI, MCP, and mode-hierarchy nodes.
Deleted stale presentation assets (2026-02 slides + voice notes).
53 lines
4.4 KiB
XML
53 lines
4.4 KiB
XML
let s = import "../schema.ncl" in
|
|
|
|
s.Domain & {
|
|
id = "provisioning",
|
|
name = "Provisioning",
|
|
repo_kinds = ["DevWorkspace", "Mixed"],
|
|
description = "Infrastructure workspace and platform commands for DevWorkspace and Mixed projects.",
|
|
short_alias = "prov",
|
|
required_extensions = [],
|
|
|
|
commands = [
|
|
{ id = "state", description = "Current FSM position across all dimensions" },
|
|
{ id = "next", description = "Next valid transitions with blockers and catalysts" },
|
|
{ id = "validate <decision>", description = "Check a decision against ontological invariants" },
|
|
{ id = "connections", description = "Upstream and downstream project dependency graph" },
|
|
{ id = "gates", description = "Membrane status and opening conditions" },
|
|
{ id = "card", description = "Workspace card — identity, clusters, status (DevWorkspace only)" },
|
|
{ id = "capabilities", description = "Platform capabilities from manifest" },
|
|
{ id = "backlog [--priority]", description = "Backlog items filtered by High|Medium|Low (platform only)" },
|
|
{ id = "backlog show <id>", description = "Full detail of a backlog item" },
|
|
{ id = "install [--mode] [--platform]", description = "Install provisioning platform services (platform only)" },
|
|
|
|
# ── Ops contract (adr-037) — pending queue, signed commands, audit ──────
|
|
{ id = "ops list", description = "Pending and recent ops for the workspace (NATS ops.pending and ops.cmd subjects)" },
|
|
{ id = "ops describe <id>", description = "Full detail of a single op including JWT claims, scopes, expected_state_version" },
|
|
{ id = "ops sign <id>", description = "Operator signs a pending op via keeper-cli (requires authorized signer key)" },
|
|
{ id = "ops history [--workspace]", description = "Audit log of applied ops from <workspace>-state Radicle ledger" },
|
|
|
|
# ── Playbooks — executable operational artifacts ────────────────────────
|
|
{ id = "playbook list", description = "Available playbooks for this workspace's repo_kind" },
|
|
{ id = "playbook describe <name>", description = "Full definition (steps, params, preconditions) of a playbook" },
|
|
{ id = "playbook run <name>", description = "Execute a playbook (use --dry-run first to simulate without side effects)" },
|
|
{ id = "playbook history", description = "Past playbook executions, params, outcomes from audit ledger" },
|
|
|
|
# ── Keeper (signing daemon) status and control ──────────────────────────
|
|
{ id = "keeper status", description = "Current keeper mode (auto | operator-only | down) and policy version" },
|
|
{ id = "keeper policy", description = "Show active keeper policy for this workspace from policy-<workspace> Radicle repo" },
|
|
{ id = "keeper switch <mode>", description = "Switch keeper mode (delegates to switch_to_<mode> playbook)" },
|
|
|
|
# ── Governance (adr-038) — Radicle delegation queries ────────────────────
|
|
{ id = "governance delegations", description = "Current Radicle delegation set for the workspace's policy/desired/state repos" },
|
|
{ id = "governance signers", description = "Active signers for ops and policy (M-of-N quorum status)" },
|
|
|
|
# ── Registry (OCI / zot) ─────────────────────────────────────────────────
|
|
{ id = "i resolve-registry", description = "Resolved OCI registry endpoint: PROVISIONING_REGISTRY env → capabilities.ncl → constant fallback" },
|
|
{ id = "i list", description = "Show resolved registry endpoint without querying live catalog" },
|
|
{ id = "i list --live", description = "Query _catalog on the resolved registry; list live domains/<participant>/<id> and modes/<participant>/<id>" },
|
|
],
|
|
|
|
pages = [
|
|
{ id = "provisioning", route = "/<slug>/provisioning", title = "Provisioning (State · Connections · Gates)", template = "provisioning", nav_label = "Provisioning" },
|
|
],
|
|
}
|